powerpc/kexec_file: Prevent kexec range truncation
In the Linux kernel, the following vulnerability has been resolved: powerpc/kexec_file: Prevent kexec range truncation Sashiko AI review pointed out the following issue. The __merge_memory_ranges() function incorrectly handles overlapping memory ranges when merging them. Although sort_memory_ranges() sorts all ranges by their start address in ascending order beforehand, the merge logic remains defective in two ways: 1. It compares the current range's start against the previous element (i-1) instead of the running target index (idx) 2. It unconditionally overwrites 'ranges[idx].end' with 'ranges[i].end'. This logic flaw leads to critical memory truncation when a larger memory range completely subsumes subsequent smaller ranges. For example, consider a sorted input array with three ranges: Range A (idx=0): [0x1000 - 0x9000] Range B (i=1): [0x2000 - 0x5000] (completely inside Range A) Range C (i=2): [0x6000 - 0x8000] (completely inside Range A) 1. When i=1 (Range B): ranges[1].start (0x2000) <= ranges[0].end + 1 (0x9001) is TRUE. The code executes: ranges[0].end = ranges[1].end, which erroneously shrinks Range A's end from 0x9000 down to 0x5000. 2. When i=2 (Range C): ranges[2].start (0x6000) <= ranges[1].end + 1 (0x5001) is FALSE. The code falls into the else block, creating a broken new range. As a result, valid memory fragments [0x5001 - 0x5fff] and [0x8001 - 0x9000] are completely lost from the kexec exclude lists, potentially allowing the crash kernel to overwrite active me
CVE-2026-89962
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-89962
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "180adfc532a83c1d74146449f7385f767d4b8059",
"lessThan": "ffbdc2a3834a3e47bac7236a71bbc82b45c83832",
"versionType": "git"
},
{
"status": "affected",
"version": "180adfc532a83c1d74146449f7385f767d4b8059",
"lessThan": "9ef63622e6cee588ea4b763a6afc87065254b36a",
"versionType": "git"
},
{
"status": "affected",
"version": "180adfc532a83c1d74146449f7385f767d4b8059",
"lessThan": "da88a2a2119e4fd0e8919a7a2448682f574e1545",
"versionType": "git"
},
{
"status": "affected",
"version": "180adfc532a83c1d74146449f7385f767d4b8059",
"lessThan": "c4cb547f26d9b73b489c5278d0c8db837c5a174f",
"versionType": "git"
},
{
"status": "affected",
"version": "180adfc532a83c1d74146449f7385f767d4b8059",
"lessThan": "fa40f9dbdd4af53e7445d9135b5b207eb8adf372",
"versionType": "git"
}
],
"programFiles": [
"arch/powerpc/kexec/ranges.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.9",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/powerpc/kexec/ranges.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-89962
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #48572 · Revision 1
- Added to Heist Feed
- Publisher date